The data being harvested today doesn’t need quantum computers to be dangerous — it just needs to wait. “Harvest now, decrypt later” means your 2026 ciphertext is already in the adversary’s vault, and Q-Day is its alarm clock. Here’s the migration guide.
Quick Answer
Q-Day — the day a cryptographically relevant quantum computer breaks RSA/ECC via Shor’s algorithm — may be years out, but harvest-now-decrypt-later attacks make it today’s problem: data exfiltrated now gets decrypted later. NIST’s finalized PQC standards (ML-KEM/Kyber, ML-DSA/Dilithium, SLH-DSA/SPHINCS+, FN-DSA/Falcon) are production-ready, and hybrid TLS key exchange (classical + ML-KEM) is supported by OpenSSL 3.2+, major clouds, and CDNs at sub-millisecond overhead. The five moves that matter: inventory every cryptographic asset, build crypto-agility into systems, deploy hybrid now, migrate long-lived secrets first (10-year certificates, archives, classified and medical data), and brief the board — EU NIS2-style regimes are starting to treat quantum readiness as an obligation, not an option.
The Quantum Clock Is Ticking
Modern security rests on one assumption: RSA-2048, AES-256, and elliptic-curve cryptography are computationally infeasible to break. A classical supercomputer needs astronomical time to factor RSA-2048. A sufficiently large quantum computer running Shor’s algorithm does it in hours.
“Q-Day” — the moment a quantum computer can break current public-key cryptography at scale — is no longer science fiction. The engineering trajectory (error correction, logical qubit counts, algorithmic improvements) keeps shortening estimates, and organizations that haven’t started migrating are already behind their data’s own lifetime.
The Threat Is Already Active: Harvest Now, Decrypt Later
Adversaries — most prominently nation-state actors — are stealing encrypted data today on the bet that quantum computers will crack it within the data’s secrecy horizon:
- Encrypted diplomatic and defense communications captured in 2024 could be plaintext intelligence by the end of the decade
- VPN tunnels, TLS sessions, and long-lived certificates protecting archives are prime collection targets
- The attack doesn’t require the adversary to do anything else — just store and wait
This is why post-quantum migration is a now problem: every year of classical-only encryption extends the pool of harvestable secrets. It sits alongside the other slow-burn infrastructure risks we’ve covered — from trusted-infrastructure abuse to secrets embedded in supply chains.
NIST’s Post-Quantum Standards: What’s Shipping
NIST finalized its first post-quantum cryptographic standards and the suite has hardened into four pillars:
| Standard | Base | Role | Status |
|---|---|---|---|
| ML-KEM (CRYSTALS-Kyber) | Lattice | Key encapsulation — TLS handshakes | Deployed by Google, Apple, Cloudflare |
| ML-DSA (CRYSTALS-Dilithium) | Lattice | Digital signatures replacing RSA/ECDSA | Adoption growing in PKI |
| SLH-DSA (SPHINCS+) | Hash-based | Conservative signature backup | For high-assurance use |
| FN-DSA (FALCON) | Lattice (NTRU) | Compact signatures for constrained devices | Completing the suite |
By 2026, major platforms run hybrid deployments — classical and quantum-resistant algorithms together — so neither a quantum break nor a weakness found in a new lattice scheme collapses the system. That’s crypto-agility in practice.
The 2026 Quantum Threat Landscape
- Hardware progress: leading labs (IBM, Google, Chinese groups) push logical-qubit counts upward faster than older forecasts; still far from the scale needed for RSA-2048, but the curve is the threat
- Nation-state investment: governments are pouring tens of billions into quantum computing and quantum-safe migration; China’s 4,600 km quantum-communication backbone shows operational infrastructure exists today
- Supply chain exposure: firmware, VPN appliances, HSMs, and certificate authorities embedding long-lived keys are the softest harvest-now targets
- Research pressure: cryptanalysts keep probing lattice constructions with classical and quantum-inspired attacks — exactly why hybrid and agility matter
What Security Professionals Must Do Now
1. Inventory Your Cryptographic Assets
You can’t migrate what you can’t see. Audit every certificate, key store, API secret, and encrypted archive; classify by data sensitivity and key lifetime.
2. Implement Crypto-Agility
Systems must swap algorithms without re-architecture. If TLS termination, database encryption, or app-layer crypto is hard-coded to one algorithm, that’s technical debt with a quantum maturity date.
3. Start Hybrid Deployments
Don’t wait for pure PQC. Hybrid key exchange (classical + ML-KEM) works today in OpenSSL 3.2+, nginx, and major clouds — typically under 1ms added latency.
4. Prioritize Long-Lived Secrets
Decade-valid certificates, archived ciphertexts, classified material, medical records: anything whose secrecy must outlast the Q-Day uncertainty window migrates first.
5. Educate the Organization
Quantum readiness is a boardroom issue: Q-Day timelines, regulatory expectations (NIS2-era regimes increasingly reference crypto-agility and quantum readiness), and the cost of inaction. Pair it with the identity-side modernization you already need — least-privilege identity and zero trust architecture share the same “assume compromise, limit blast radius” logic.
Frequently Asked Questions
When is Q-Day expected?
Estimates range from the early 2030s to “never knows” — and that uncertainty is the point. Harvest-now-decrypt-later means data stolen today is already at risk regardless of when the break happens. Migration timelines for large organizations (5–10 years) mean starting now is the only safe schedule.
What are NIST’s post-quantum standards?
Four finalized standards: ML-KEM (Kyber) for key encapsulation, ML-DSA (Dilithium) for signatures, SLH-DSA (SPHINCS+) as the hash-based conservative backup, and FN-DSA (FALCON) for compact signatures. Together they replace RSA and ECC across TLS, PKI, and code signing.
What is harvest now, decrypt later?
An attack model where adversaries collect encrypted data today — betting quantum computers will decrypt it within the data’s useful lifetime. It targets long-lived secrets: diplomatic traffic, health records, archived databases. The only defense is encrypting that data quantum-safely before it’s captured.
Will post-quantum encryption slow my systems down?
Barely. Hybrid TLS with ML-KEM adds typically under 1ms per handshake, and optimized implementations keep signature operations in the same range as classical ECDSA. The operational cost is migration engineering, not runtime performance.
References
- NIST — Post-Quantum Cryptography Standardization (ML-KEM, ML-DSA, SLH-DSA, FN-DSA)
- IETF — hybrid key exchange drafts for TLS (X25519 + ML-KEM)
- Cloudflare / Google / Apple — production ML-KEM deployment reporting
- China quantum-communication backbone (4,600 km) coverage
- Hmmnm — Software Supply Chain Security: Dependencies, Builds, Secrets
- Hmmnm — Zero Trust Architecture for AI Systems
- Hmmnm — Agent Identity and Least Privilege
